Back to home

Privacy Policy

This describes what 13x does with data today: running audits, keeping an optional account workspace, privately evaluating Operate, attributing referrals, and running an early-access waitlist. There is no payment processing and no advertising.

When you run an audit

No account is required. For each audit we store:

  • The URL you submitted and the domain derived from it.
  • The findings — which checks passed and failed, and the evidence behind each one, such as the title we read or the tracker we saw.
  • Technical facts about the site — the framework we detected, the response times, the language.
  • A hashed version of your IP address, used only to enforce the limit of three audits per hour. We store a one-way hash, not the address itself, and it cannot be reversed into an IP.

Our crawler identifies itself as 13xBot, respects robots.txt, and requests at most 25 pages of the site being audited. Evidence Replay also makes one bounded request as each named search or AI crawler so the report can show the response that agent received. When you are signed in, the audit is associated with your account so it appears in your dashboard. Anonymous audits are not attached later.

If rendered evidence is configured, a browser provider opens the submitted public URL and records a screenshot, rendered-text measurements, limited accessibility samples, cookies and classified third-party requests before a consent choice and after attempting the page's accept and reject controls. The provider receives the URL and page content needed to render it. If no provider is configured, these fields stay explicitly unavailable.

Report pages are unlisted, not private

Every audit produces a report at a URL containing a random token. Those pages are marked noindex, nofollow so they do not appear in search results, but anyone who has the link can open one. Treat a report link the way you would treat any unlisted link: do not share it if you would not want it forwarded.

When you join the waitlist

  • Your email address — so we can tell you when early access opens.
  • Your four answers — what kind of launcher you are, how often you launch, how you feel about repository access, and optionally what takes you the most time. These decide what we build next.
  • Which report you came from, if any, so the right fixes unlock.
  • Campaign parameters from the link you arrived through, and your browser user agent.

We use a double opt-in: you get one email asking you to confirm, and until you click it we do not send you anything else. That confirmation is the legal basis for contacting you, and you can withdraw it at any time.

When you create an account

  • Your name and email address, used to identify your workspace and send verification or recovery emails.
  • A one-way password hash. We never store or email the password you entered. A password cannot be reconstructed from the stored value.
  • Session and one-time token hashes, expiry times and verification status. The raw session token stays in an HttpOnly browser cookie; only its hash is stored in the database so sessions can be revoked.
  • Your audit history, consisting of the audits started while you were signed in.

Sign-in, registration and recovery attempts are rate limited using one-way hashes derived from the connection and account identifier. These records exist only to prevent automated abuse.

When you use Operate

Operate derives one compact product model from the public live site already read by the audit. It contains observed routes, schema, authentication and payment signals, detected dependencies, and limited brand and audience clues. The same crawl context supplies the independent SEO, AEO, Marketing, Compliance and Security workstreams. Repository state stays unknown unless you explicitly connect GitHub.

When you connect GitHub or create a fix plan

GitHub gives us an access token and your GitHub account identifier and login. The token is encrypted at rest and is used only for repository actions you request. We list repositories available to that token and, when you select one, read a bounded set of relevant source and configuration files while excluding common secret, lock, and generated paths.

A fix plan stores the repository name, selected finding IDs, a patch preview, branch and pull-request state. The full plan is encrypted. If model-assisted planning is enabled, the selected findings and bounded file contents are sent to Anthropic to propose conservative full-file patches. Without that key, 13x produces an evidence record and CI workflow and names the remaining fixes as unresolved. 13x writes only after your second explicit action, uses an isolated branch, and rechecks current file contents before every write.

When you install the 13x collector

The collector is attached to a project with a public project key and accepts signals only from that project's domain or its subdomains. It records the page path and title, referrer origin, Core Web Vitals, and conversion or custom events you explicitly name. Query strings and fragments are removed before storage.

The collector does not set cookies or create a visitor identifier. It does not store IP addresses, full referrer URLs, input values, page content, session recordings, or fingerprints. Custom event metadata is limited in size; you are responsible for not placing personal or secret data in event names or metadata. You can delay collection until consent by using the documented manual-start option.

When you enable monitoring

We store the URL, cadence, latest baseline and run timestamps. An optional Slack or Discord webhook URL is restricted to the provider's official webhook host and encrypted at rest. Scheduled results are sent directly to that webhook; its provider then processes the message under your agreement with them.

During private dogfood we store whether a finding in your signed-in audit was opened, how many times it was opened, and whether you marked it changed. The fixed 28-day window begins with the first completed signed-in audit, so never-opened findings stay in the evidence set. We use the resulting per-check cut list to decide which briefs and instructions deserve further development. Operate does not automatically generate or publish articles.

When you follow a referral link

A valid referral link sets a first-touch attribution cookie for 30 days. The cookie is HttpOnly, SameSite=Lax, and used only to connect a later registration with the referring account; JavaScript on the page cannot read it. It is not an advertising or cross-site tracking cookie.

If you register, we store the referring and referred account identifiers, the referral status, and qualification or rejection timestamps. A referral qualifies only after both accounts have verified their email addresses and the referred user completes their first signed-in audit. The resulting ledger records one banked Pro month for the referrer. The reward has no cash value. Billing is not live, no payment method is collected, and the reward does not start a subscription.

What we do not do

We do not sell your data, share it with advertisers, or send you mail unrelated to 13x. We do not read a repository until its owner explicitly connects GitHub and requests a plan, and we never push to the default branch. Operate produces briefs and instructions for a person to review; it does not auto-generate or publish articles.

Analytics

If product analytics are enabled on this deployment, we record a small set of events: page views, audits started and completed, whether a signup succeeded, and whether a report or referral link was copied or shared. Autocapture and session recording are switched off and Do Not Track is respected. When no analytics key is configured, no analytics script loads and no analytics cookie is set.

Where the data lives

Accounts, audits, collector signals and signups are stored in a PostgreSQL database hosted by Neon. Transactional email is sent through Resend. The application is hosted through OpenAI Sites on Cloudflare infrastructure. Optional features also use GitHub, Anthropic, a configured browser provider, and Slack or Discord when you supply their webhook. Each processor may store data outside your country; we rely on the applicable contractual safeguards for transfers.

How long we keep it

  • Audits and findings: retained so the report link keeps working, and in aggregate to publish statistics about how common each problem is. Aggregate statistics contain no domains and no personal data.
  • Collector signals:raw event rows are scheduled for deletion once they are 90 days old. The project's lifetime signal count and latest-signal time remain until the project or account is deleted.
  • Rate-limit records: a few hours.
  • Account sessions: until they expire after 30 days, you sign out, or a password change revokes them. One-time recovery tokens expire after one hour; verification tokens expire after 24 hours.
  • Accounts: until you ask us to delete yours. Deleting an account removes its profile and active sessions; existing reports may be retained without the account association for the reasons above.
  • Operate evidence: opened and changed finding records remain associated with your account until you ask us to delete it. The private dogfood decision uses only activity inside the fixed 28-day window.
  • Integrations, fix plans, and monitors: retained while the account or feature record remains active. Disconnecting GitHub removes its encrypted token; deleting a monitor removes its encrypted webhook target.
  • Referral attribution: the browser cookie expires after 30 days. Account-to-account attribution and the reward ledger are retained so a referral cannot be counted twice and a banked reward can be honoured or revoked. If a referred account is deleted after qualification, its account identifier is removed from the attribution while the anonymous qualification record and already-banked month remain.
  • Waitlist entries: until early access has finished rolling out, or until you ask us to delete yours.

Your rights

You can ask to see, correct, export or delete your data, or to have a specific report removed, by emailing hello@get13x.dev. We will respond within 30 days. Depending on where you live you may also have the right to complain to a data protection authority.

Changes

If this policy changes materially, we will say so on this page and email everyone on the waitlist before the change takes effect.